Embodiments of the present invention relate to methods, apparatus and systems for securing user-associated passwords used for identity authentication, and in particular to securing user-associated passwords that are used for authenticating the identity of parties engaged in transactions.
An increasing number of people engage in electronic transactions, telephone transactions, and other types of transactions in which at least one of the parties to the transaction relies on funds or other types of value to be provided or distributed by an entity other than that party. For example, an individual engaged in a purchase transaction with a merchant may rely on their banking institution to provide funds to the merchant through a bank or credit account held by the banking institution for the individual. In these types of transactions, it is often desirable to authenticate the identity of the party (e.g., the individual) to reduce the risk of unauthorized transactions.
Various techniques for authenticating the identity of a party engaged in a transaction include some form of soliciting the party for a user-associated password, where the party has previously registered the user-associated password with an authenticating agent. For example, the user-associated password may be a personal identification number (PIN) registered by the party at the banking institution at which the party holds funds. This type of PIN is often entered at and passed through a merchant during a transaction. For another example, the user-associated password may be a password that is solicited by an account issuer and which, during a transaction with a merchant, is communicated to the account issuer while bypassing the merchant. A recently developed security protocol that uses such passwords is the 3-D Secure protocol that has been implemented by various account issuers and marketed under names such as Verified by Visa™ (by Visa, Inc. of San Francisco, Calif.), MasterCard Securecode™ (by MasterCard Worldwide, Inc. of New York, N.Y.), J/Secure™ (by JCB Co., Ltd of Tokyo, Japan), and SafeKey™ (by American Express Co. of New York, N.Y.).
While the use of user-associated passwords increases the integrity of transactions, problems with engaging in secure transactions still widely persist. For example, if an unauthorized third party gains access to the user-associated password of another, they may use that user-associated password to engage in unauthorized transactions by posing themselves as the party which registered the user-associated password.